DOGE worker’s code supports NLRB whistleblower • Hacker News Board

Re: DOGE worker’s code supports NLRB whistleblower

#51

Post by nativeit » Wed, Apr 23, 2025, 9:43 PM UTC

progbits wrote: post #45

> Ge0rg3’s code is “open source,” in that anyone can copy it and reuse it non-commercially. As it happens, there is a newer version of this project that was derived or “forked” from Ge0rg3’s code — called “async-ip-rotator” — and it was committed to GitHub in January 2025 by DOGE captain Marko Elez. Original code: https://github.com/Ge0rg3/requests-ip-rotator Forked: https://github.com/markoelez/async-ip-rotator Code…

> On February 6, someone posted a lengthy and detailed critique of Elez’s code on the GitHub “issues” page for async-ip-rotator, calling it “insecure, unscalable and a fundamental engineering failure.”

“If this were a side project, it would just be bad code,” the reviewer wrote. “But if this is representative of how you build production systems, then there are much larger concerns. This implementation is fundamentally broken, and if anything similar to this is deployed in an environment handling sensitive data, it should be audited immediately.”

Re: DOGE worker’s code supports NLRB whistleblower

#52

Post by BriggyDwiggs42 » Wed, Apr 23, 2025, 9:44 PM UTC

hahajk wrote: post #33

I have a theory that "business ethics" is really just "following the law." In capitalism, outside a few select industries like journalism, as long as it's legal you can - and should - do anything to maximize profits. It has turned into (or perhaps always was) the govt's job to set those rules. Now, the govt also has to create rules for itself. So it creates the Privacy Act and layers of beurocratic checks and balance…

Yeah actually. I think that’s about right.

Re: DOGE worker’s code supports NLRB whistleblower

#53

Post by mikeyouse » Wed, Apr 23, 2025, 9:44 PM UTC

tw04 wrote: post #3

Someone needs to go to prison over this. It’s not just a misunderstanding, it is an intentional attack on every US citizen.

I fully believe there's a stack of pardons in Trump's drawer for everyone involved in this debacle. I can't imagine breaking so many laws all over the government if you thought you'd ever have to face consequences. The alternative to pardons in preventing the next congress & administration from cleaning this up is too dire to really contemplate.

Re: DOGE worker’s code supports NLRB whistleblower

#54

Post by malfist » Wed, Apr 23, 2025, 9:44 PM UTC

the_optimist wrote: post #21

malfist wrote: post #7

Earlier quoted context omitted.

If I told you someone went to your bank and demanded the right to setup accounts with permissions to do everything and to have all logging of that users activity disabled, and then a whistleblower pointed out that they downloaded everyone's bank statements, you'd probably be pretty up set. After all, why do they need unfettered access? Why do they need your bank statements? Why do they need to hide what they're doing…

[flagged]

Might doesn't make right

Re: DOGE worker’s code supports NLRB whistleblower

#55

Post by XorNot » Wed, Apr 23, 2025, 9:44 PM UTC

pan69 wrote: post #40

twalkz wrote: post #8

> According to a whistleblower complaint filed last week by Daniel J. Berulis, a 38-year-old security architect at the NLRB, officials from DOGE met with NLRB leaders on March 3 and demanded the creation of several all-powerful “tenant admin” accounts that were to be exempted from network logging activity that would otherwise keep a detailed record of all actions taken by those accounts. Feels like a pretty good Occa…

> all-powerful “tenant admin” accounts that were to be exempted from network logging activity Is this normal to build this sort of functionality into a software system? Especially software systems that heavily rely on auditability?

It's the same as domain admin in active directory.

You always need it to setup the system initially.

It's like root on Linux: it's an implementation detail that it must be possible.

Re: DOGE worker’s code supports NLRB whistleblower

#56

Post by happyopossum » Wed, Apr 23, 2025, 9:44 PM UTC

tw04 wrote: post #3

Someone needs to go to prison over this. It’s not just a misunderstanding, it is an intentional attack on every US citizen.

You’d have to prove a crime here to send someone to jail, correct? What would the charges be?

Re: DOGE worker’s code supports NLRB whistleblower

#57

Post by growdark » Wed, Apr 23, 2025, 9:45 PM UTC

>Ge0rg3’s code is “open source,” in that anyone can copy it and reuse it non-commercially.

A little nit-picking, but that's not what open source means, especially as it relates to the GPL in this case. If you can't use the code commercially, it's neither "open source" (as defined by OSI) nor free software (as defined by the FSF).

Re: DOGE worker’s code supports NLRB whistleblower

#58

Post by jiggawatts » Wed, Apr 23, 2025, 9:45 PM UTC

This is much ado about nothing. The article tries to very hard to make something ordinary sound nefarious.

This appears to be DOGE employees simply doing their job.

You may not agree with what they’re doing in a political sense, but if you were tasked with the same problem you’d come up with a nearly identical solution.

For example: “tenant admin” is probably the special role that can bypass access control (not audits!) and see and read all data.

This sounds scary but I regularly request this right from large government departments and I get it granted to me.

Its use is justified when normal access requests would be too complex / fiddly and error prone. Generally, in a large environment, there is no other way to guarantee 100% coverage because as an outsider you don’t even know what permissions to ask for if you can’t see anything due to a lack of permissions!

Seriously: sit down for a second and think about how you would go about getting access to make a full copy of an organisation’s data for an audit if you fully expect both passive resistance and even active efforts to hide the very things you’re looking for.

Re: DOGE worker’s code supports NLRB whistleblower

#59

Post by nativeit » Wed, Apr 23, 2025, 9:45 PM UTC

nop_slide wrote: post #46

I find the following bizarre. Ignoring who this marko guy is, why would a random person post such a "take down" of the repo? I have never randomly passed by a repo and wanted to just dunk on it. Also this critique reeks of being AI generated. > On February 6, someone posted a lengthy and detailed critique of Elez’s code on the GitHub “issues” page for async-ip-rotator, calling it “insecure, unscalable and a fundament…

Why wonder? The user who wrote it seems to be a pretty well established user, and their public repositories suggest that they work in adjacent contexts, so it's entirely plausible they attempted to use async-ip-rotator in one of their projects.

Re: DOGE worker’s code supports NLRB whistleblower

#60

Post by watwut » Wed, Apr 23, 2025, 9:45 PM UTC

nop_slide wrote: post #46

I find the following bizarre. Ignoring who this marko guy is, why would a random person post such a "take down" of the repo? I have never randomly passed by a repo and wanted to just dunk on it. Also this critique reeks of being AI generated. > On February 6, someone posted a lengthy and detailed critique of Elez’s code on the GitHub “issues” page for async-ip-rotator, calling it “insecure, unscalable and a fundament…

Are you genuinely puzzled or just wanted an excuse to point us all toward that comment? If "the comment" is correct word for what amounts to full article in length.